rfc: user data domain separation - #12
Conversation
| ## Open Questions | ||
|
|
||
| - Is `filone.com` the right domain? | ||
| - PSL scope: list `filone.com` itself or `s3.filone.com`? |
There was a problem hiding this comment.
What do you think about using <bucket_name>.<region>.s3.filone.com/<bucket_name>? That way we could:
- Isolate the malicious bucket flagged by PSL without flagging the top domain
- Keep the bucket name in the path
This would probably require an extra check performed by the gateway to make sure that path and domain bucket name match before serving the request.
There was a problem hiding this comment.
I think that makes it harder to switch to pure bucket-in-subdomain when we want to do public buckets...
Do you know what the reason for using path based was originally? I think we should switch to subdomain based ASAP.
There was a problem hiding this comment.
I don't know the exact reason to be honest, but I believe it was related to service providers not supporting the feature. Would be good to double check with them.
pyropy
left a comment
pyropy
left a comment
There was a problem hiding this comment.
This proposal sounds reasonable to me. However I'd like to discuss usage of bucket names in the subdomain which could probably grow into it's own RFC.
bajtos
left a comment
bajtos
left a comment
There was a problem hiding this comment.
👏🏻
I agree we should support including the bucket name in the domain name (instead of the path) ASAP, but I think that's a small, incremental addition to this proposal that's not blocking this PR from landing.
4 participants
📖 Preview
Summary
Move
<region>.s3.fil.oneto<region>.s3.filone.com.